I have an Always On Availability Group with a read-only secondary set up. We're running SQL Server 2016 Enterprise Edition SP1 CU4. Users are supposed to only connect to the secondary using the ReadOnly ApplicationIntent when connecting to the listener. I don't want to remove their logins from the primary since this would prohibit access after a failover. I am looking at perhaps running a SQL Agent job that checks connections and kills sessions if they are running on the primary but it seems like there should be a better way to do that than running a job every minute or so! Do I need to look at creating an audit or is there some other mechanism to accomplish this?